Function key_register_ifnet

freebsd/netipsec/key.c:1263–1305

* Insert a bunch of VTI secpolicies into the SPDB. * We keep VTI policies in the separate list due to following reasons: * 1) they should be immutable to user's or some deamon's attempts to * delete. The only way delete such policies - destroy or unconfigure * corresponding virtual inteface. * 2) such policies have traffic selector that matches all traffic per * address family. * S

 * policies order.
 */
int
key_register_ifnet(struct secpolicy **spp, u_int count)
{
	struct mbuf *m;
	u_int i;

	SPTREE_WLOCK();
	/*
	 * First of try to acquire id for each SP.
	 */
	for (i = 0; i < count; i++) {
		IPSEC_ASSERT(spp[i]->spidx.dir == IPSEC_DIR_INBOUND ||
		    spp[i]->spidx.dir == IPSEC_DIR_OUTBOUND,
		    ("invalid direction %u", spp[i]->spidx.dir));

		if ((spp[i]->id = key_getnewspid()) == 0) {
			SPTREE_WUNLOCK();
			return (EAGAIN);
		}
	}
	for (i = 0; i < count; i++) {
		TAILQ_INSERT_TAIL(&V_sptree_ifnet[spp[i]->spidx.dir],
		    spp[i], chain);
		/*
		 * NOTE: despite the fact that we keep VTI SP in the
		 * separate list, SPHASH contains policies from both
		 * sources. Thus SADB_X_SPDGET will correctly return
		 * SP by id, because it uses SPHASH for lookups.
		 */
		LIST_INSERT_HEAD(SPHASH_HASH(spp[i]->id), spp[i], idhash);
		spp[i]->state = IPSEC_SPSTATE_IFNET;
	}
	SPTREE_WUNLOCK();
	/*
	 * Notify user processes about new SP.
	 */
	for (i = 0; i < count; i++) {
		m = key_setdumpsp(spp[i], SADB_X_SPDADD, 0, 0);
		if (m != NULL)
			key_sendup_mbuf(NULL, m, KEY_SENDUP_ALL);
	}
	return (0);
}

void
key_unregister_ifnet(struct secpolicy **spp, u_int count)